import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
import { CacheService } from '@backstage/backend-plugin-api';
import * as _backstage_plugin_auth_node from '@backstage/plugin-auth-node';
import { ProxyAuthenticator } from '@backstage/plugin-auth-node';

/**
 * Can be used in externally provided auth handler or sign in resolver to
 * enrich user profile for sign-in user entity
 *
 * @public
 */
type CloudflareAccessClaims = {
    /**
     * `aud` identifies the application to which the JWT is issued.
     */
    aud: string[];
    /**
     * `email` contains the email address of the authenticated user.
     */
    email: string;
    /**
     * iat and exp are the issuance and expiration timestamps.
     */
    exp: number;
    iat: number;
    /**
     * `nonce` is the session identifier.
     */
    nonce: string;
    /**
     * `identity_nonce` is available in the Application Token and can be used to
     * query all group membership for a given user.
     */
    identity_nonce: string;
    /**
     * `sub` contains the identifier of the authenticated user.
     */
    sub: string;
    /**
     * `iss` the issuer is the application’s Cloudflare Access Domain URL.
     */
    iss: string;
    /**
     * `custom` contains SAML attributes in the Application Token specified by an
     * administrator in the identity provider configuration.
     */
    custom: string;
};
/**
 * @public
 */
type CloudflareAccessGroup = {
    /**
     * Group id
     */
    id: string;
    /**
     * Name of group as defined in Cloudflare zero trust dashboard
     */
    name: string;
    /**
     * Access group email address
     */
    email: string;
};
/**
 * @public
 */
type CloudflareAccessIdentityProfile = {
    id: string;
    name: string;
    email: string;
    groups: CloudflareAccessGroup[];
};
/**
 * @public
 */
type CloudflareAccessResult = {
    claims: CloudflareAccessClaims;
    cfIdentity: CloudflareAccessIdentityProfile;
    expiresInSeconds?: number;
    token: string;
};

/**
 * Implements Cloudflare Access authentication.
 *
 * @public
 */
declare function createCloudflareAccessAuthenticator(options?: {
    cache?: CacheService;
}): ProxyAuthenticator<unknown, CloudflareAccessResult, CloudflareAccessResult>;

/**
 * The Cloudflare Access provider backend module for the auth plugin.
 *
 * @public
 */
declare const authModuleCloudflareAccessProvider: _backstage_backend_plugin_api.BackendFeature;

/**
 * Available sign-in resolvers for the Cloudflare Access auth provider.
 *
 * @public
 */
declare namespace cloudflareAccessSignInResolvers {
    /**
     * Looks up the user by matching their email to the entity email.
     */
    const emailMatchingUserEntityProfileEmail: _backstage_plugin_auth_node.SignInResolverFactory<CloudflareAccessResult, {
        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
    } | undefined>;
}

export { cloudflareAccessSignInResolvers, createCloudflareAccessAuthenticator, authModuleCloudflareAccessProvider as default };
export type { CloudflareAccessClaims, CloudflareAccessGroup, CloudflareAccessIdentityProfile, CloudflareAccessResult };